File names available in plaintext after logout using SDDM
- Dominant language
- Go
- Stars
- 1k
- Forks
- 111
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 3
Description
When using SDDM display manager, **filenames are still available in plaintext after user logs out**. It's weird as **file contents remain encrypted**. **It doesn't happen if user logs in from console**. It also happened before https://github.com/google/fscrypt/issues/57 was fixed and I executed `fscrypt purge` command on exit from script.
```
fscrypt --version
Version:
0.2.1-9-gd6efd2a
```
**Encrypted directory status before login:**
```
# fscrypt status /home/user1/
"/home/user1" is encrypted with fscrypt.
Policy: 949471831dcf55cf
Unlocked: No
Protected with 1 protector:
PROTECTOR LINKED DESCRIPTION
6682ae84e70e99b3 Yes (/) login protector for user1
```
**Encrypted directory view before login:**
```
# ls -al /home/user1
total 44
drwxr-xr-x 8 user1 user1 4096 Oct 1 21:55 .
drwxr-xr-x 6 root root 4096 Sep 3 16:10 ..
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 4KuOWyB8JVvtSjQ5wWBs+3UWsPIAtebNN03,X6EhRRD
-rw------- 1 user1 user1 51 Oct 1 21:55 7Gkj14k6MhIjhqp,YpbkzY0ZmW5CZ8NWfjtIUvuXVYN
drwxr-xr-x 4 user1 user1 4096 Oct 1 21:56 cYjQyFUTZ0aueNUy49A2gC6rqu+hr9YqG+J0YxZuogN
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 dUJK0ZvNyVKTTyY2aT4uwV70oxGuP4UpaaNTHH6f,PI
-rw------- 1 user1 user1 16 Oct 1 21:55 gaVOjkDXQ,epFAzE0U9oaiJ1RZegg,E46fybSNZxyZJ
drwxr-xr-x 12 user1 user1 4096 Oct 1 21:56 GhiHtwJJ6Udq2iruRTdskoM3gOuZO0qwD8Y7db9ViYK
-rw-r--r-- 1 user1 user1 336 Oct 1 21:55 mA2atU6muhkdiJ8+x11CDrSijNnTx6GymhU5fZQSIRM
drwx------ 2 user1 user1 4096 Oct 1 21:55 t3rX5lOToba9YDfnn,05o5AOxqs,8C+lilp7ayKpy5M
drwx------ 2 user1 user1 4096 Oct 1 21:55 xavy48JtAUzUGMEFTKfrwd,ckOdtF0I09FkVArPrg1N
```
**user1 logs in:**
```
# journalctl -f |grep fscrypt
pam_fscrypt[1162]: Authenticate()
pam_fscrypt[1162]: Setreuid(1001, 0) =
pam_fscrypt[1162]: keyringID(_uid.1001) = 848488077,
pam_fscrypt[1162]: Setreuid(0, 1001) =
pam_fscrypt[1162]: KeyctlLink(848488077, -2) =
pam_fscrypt[1162]: Setreuid(0, 0) =
pam_fscrypt[1162]: keyringID(_uid.0) = 698375302,
pam_fscrypt[1162]: KeyctlLink(698375302, -2) =
pam_fscrypt[1162]: KeyctlLink(848488077, 698375302) =
pam_fscrypt[1162]: Setting privileges to "user1"
pam_fscrypt[1162]: Setregid(-1, 1001) =
pam_fscrypt[1162]: Setgroups([1001 6 7 90 91 92 93 95 96 98]) =
pam_fscrypt[1162]: Setreuid(-1, 1001) =
pam_fscrypt[1162]: Reading config from "/etc/fscrypt.conf"
pam_fscrypt[1162]: creating context for "user1"
pam_fscrypt[1162]: found ext4 filesystem "/" (/dev/sda)
pam_fscrypt[1162]: listing descriptors in "/.fscrypt/protectors"
pam_fscrypt[1162]: found 1 descriptor(s)
pam_fscrypt[1162]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1162]: Getting protector 6682ae84e70e99b3 from option
pam_fscrypt[1162]: copying AUTHTOK for use in the session open
pam_fscrypt[1162]: Setting privileges to "root"
pam_fscrypt[1162]: Setreuid(-1, 0) =
pam_fscrypt[1162]: Setregid(-1, 0) =
pam_fscrypt[1162]: Setgroups([0 1 2 3 4 6 10 19]) =
pam_fscrypt[1162]: pam func succeeded
pam_fscrypt[1162]: OpenSession()
pam_fscrypt[1162]: Session count for UID=1001 updated to 1
pam_fscrypt[1162]: KeyctlLink(848488077, 698375302) =
pam_fscrypt[1162]: Setting privileges to "user1"
pam_fscrypt[1162]: Setregid(-1, 1001) =
pam_fscrypt[1162]: Setgroups([1001 6 7 90 91 92 93 95 96 98]) =
pam_fscrypt[1162]: Setreuid(-1, 1001) =
pam_fscrypt[1162]: Reading config from "/etc/fscrypt.conf"
pam_fscrypt[1162]: creating context for "user1"
pam_fscrypt[1162]: found ext4 filesystem "/" (/dev/sda)
pam_fscrypt[1162]: listing descriptors in "/.fscrypt/protectors"
pam_fscrypt[1162]: found 1 descriptor(s)
pam_fscrypt[1162]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1162]: Getting protector 6682ae84e70e99b3 from option
pam_fscrypt[1162]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1162]: listing descriptors in "/.fscrypt/policies"
pam_fscrypt[1162]: found 1 descriptor(s)
pam_fscrypt[1162]: successfully read metadata from "/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[1162]: got data for 949471831dcf55cf from "/"
pam_fscrypt[1162]: successfully read metadata from "/.fscrypt/policies/1
```
**Encrypted directory view after user1 login:**
```
# ls -al /home/user1
total 44
drwxr-xr-x 8 user1 user1 4096 Oct 1 21:59 .
drwxr-xr-x 6 root root 4096 Sep 3 16:10 ..
drwxr-xr-x 4 user1 user1 4096 Oct 1 21:56 .cache
drwxr-xr-x 12 user1 user1 4096 Oct 1 21:59 .config
drwx------ 2 user1 user1 4096 Oct 1 21:55 Desktop
-rw------- 1 user1 user1 16 Oct 1 21:55 .esd_auth
-rw-r--r-- 1 user1 user1 336 Oct 1 21:55 .gtkrc-2.0
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 .kde4
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 .local
drwx------ 2 user1 user1 4096 Oct 1 21:55 Temp
-rw------- 1 user1 user1 51 Oct 1 21:59 .Xauthority
```
**user1 logout:**
```
# journalctl -f |grep fscrypt
pam_fscrypt[1116]: CloseSession(map[debug:true lock_policies:true drop_caches:true])
pam_fscrypt[1116]: Session count for UID=1001 updated to 0
pam_fscrypt[1116]: locking polices protected with login protector
pam_fscrypt[1116]: KeyctlLink(7728276, 117932856) =
pam_fscrypt[1116]: Setting privileges to "user1"
pam_fscrypt[1116]: Setregid(-1, 1001) =
pam_fscrypt[1116]: Setgroups([1001 6 7 90 91 92 93 95 96 98]) =
pam_fscrypt[1116]: Setreuid(-1, 1001) =
pam_fscrypt[1116]: Reading config from "/etc/fscrypt.conf"
pam_fscrypt[1116]: creating context for "user1"
pam_fscrypt[1116]: found ext4 filesystem "/" (/dev/sda)
pam_fscrypt[1116]: listing descriptors in "/.fscrypt/protectors"
pam_fscrypt[1116]: found 1 descriptor(s)
pam_fscrypt[1116]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1116]: Getting protector 6682ae84e70e99b3 from option
pam_fscrypt[1116]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1116]: listing descriptors in "/.fscrypt/policies"
pam_fscrypt[1116]: found 1 descriptor(s)
pam_fscrypt[1116]: successfully read metadata from "/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[1116]: got data for 949471831dcf55cf from "/"
pam_fscrypt[1116]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1116]: listing descriptors in "/home/.fscrypt/policies"
pam_fscrypt[1116]: found 1 descriptor(s)
pam_fscrypt[1116]: successfully read metadata from "/home/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[1116]: got data for 949471831dcf55cf from "/home"
pam_fscrypt[1116]: stat /sys/firmware/efi/efivars/.fscrypt: invalid argument
pam_fscrypt[1116]: stat /sys/firmware/efi/efivars/.fscrypt/policies: invalid argument
pam_fscrypt[1116]: stat /sys/firmware/efi/efivars/.fscrypt/protectors: invalid argument
pam_fscrypt[1116]: stat /sys/kernel/debug/.fscrypt: permission denied
pam_fscrypt[1116]: stat /sys/kernel/debug/.fscrypt/policies: permission denied
pam_fscrypt[1116]: stat /sys/kernel/debug/.fscrypt/protectors: permission denied
```
**Encrypted directory status after user1 logout:**
```
# fscrypt status /home/user1/
"/home/user1" is encrypted with fscrypt.
Policy: 949471831dcf55cf
Unlocked: No
Protected with 1 protector:
PROTECTOR LINKED DESCRIPTION
6682ae84e70e99b3 Yes (/) login protector for user1
```
**Encrypted directory view after user1 logout:**
```
# ls -al /home/user1
total 44
drwxr-xr-x 8 user1 user1 4096 Oct 1 22:04 .
drwxr-xr-x 6 root root 4096 Sep 3 16:10 ..
drwxr-xr-x 5 user1 user1 4096 Oct 1 22:05 .cache
drwxr-xr-x 12 user1 user1 4096 Oct 1 22:05 .config
drwx------ 2 user1 user1 4096 Oct 1 21:55 Desktop
-rw------- 1 user1 user1 16 Oct 1 21:55 .esd_auth
-rw-r--r-- 1 user1 user1 336 Oct 1 21:55 .gtkrc-2.0
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 .kde4
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 .local
drwx------ 2 user1 user1 4096 Oct 1 21:55 Temp
-rw------- 1 user1 user1 51 Oct 1 22:04 .Xauthority
```
Contributor guide
Assessment
This issue has not been assessed yet.